Test dangling DNAME answers come with NXDOMAIN proofs

Simplistic test. Ignores the possibility of DNAME chain going through
multiple zones and/or wildcard expansions.

diff --git a/bin/tests/system/nsec3-answer/ns1/root.db.in b/bin/tests/system/nsec3-answer/ns1/root.db.in
index 2171c44239a3aeb62168b2c263645862f85b3d8d..fbddc2dca27fa19552ca73be1313d10ff972a9bc 100644 (file)
--- a/bin/tests/system/nsec3-answer/ns1/root.db.in
+++ b/bin/tests/system/nsec3-answer/ns1/root.db.in
@@ -29,7 +29,8 @@ cname.                                                CNAME   does-not-exist.
 cname.cname.                                   CNAME   cname.
 cname.ent.cname.                               CNAME   cname.cname.
 d.                                             A       10.0.0.4
-dname-nowhere.                                 DNAME   does-not-exist.
+dname-to-nowhere.                              DNAME   does-not-exist.
+; DNAME owner longer than target to avoid YXDOMAIN dependent on QNAME
 insecure.                                      NS      a.root-servers.nil.
 ns.insecure.                                   A       10.53.0.3
 a.root-servers.nil.                            A       10.53.0.1

diff --git a/bin/tests/system/nsec3-answer/tests_nsec3.py b/bin/tests/system/nsec3-answer/tests_nsec3.py
index f1b0a70154e1ddfbe9679d039c0b1ba69bc00898..578b5ddc057fbd447c19ba76833ea50691cf7216 100755 (executable)
--- a/bin/tests/system/nsec3-answer/tests_nsec3.py
+++ b/bin/tests/system/nsec3-answer/tests_nsec3.py
@@ -116,6 +116,24 @@ def test_cname_nxdomain(server, qname: dns.name.Name, named_port: int) -> None:
     check_nxdomain(chain.canonical_name, nsec3check)
 
 
+@pytest.mark.parametrize(
+    "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+)
+@given(qname=dns_names(suffix=ZONE.get_names_with_type(dns.rdatatype.DNAME)))
+def test_dname_nxdomain(server, qname: dns.name.Name, named_port: int) -> None:
+    """DNAME which terminates by NXDOMAIN, no wildcards involved"""
+    assume(qname not in ZONE.reachable)
+
+    response, nsec3check = do_test_query(qname, dns.rdatatype.A, server, named_port)
+    chain = response.resolve_chaining()
+    assume_nx_and_no_delegation(chain.canonical_name)
+
+    wname = ZONE.source_of_synthesis(chain.canonical_name)
+    assume(wname not in ZONE.reachable_wildcards)
+
+    check_nxdomain(chain.canonical_name, nsec3check)
+
+
 @pytest.mark.parametrize(
     "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
 )